diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c116b4c..c40753e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,8 +15,8 @@ jobs:
         node-version: [20, 22, 24]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..66593d6
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,51 @@
+name: Publish package
+
+on:
+  release:
+    types: [published]
+
+concurrency:
+  group: npm-publish
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    if: github.repository == 'kopachlager/prerenderbuddy-cli'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+          package-manager-cache: false
+
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Run tests
+        run: npm test
+
+      - name: Check source syntax
+        run: npm run check
+
+      - name: Verify release tag matches package version
+        shell: bash
+        run: |
+          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
+          RELEASE_VERSION="${GITHUB_REF_NAME#v}"
+          if [[ "$PACKAGE_VERSION" != "$RELEASE_VERSION" ]]; then
+            echo "package.json version $PACKAGE_VERSION does not match release tag $GITHUB_REF_NAME"
+            exit 1
+          fi
+
+      - name: Publish to npm with trusted publishing
+        run: npm publish --access public
diff --git a/README.md b/README.md
index 6921ad1..ec79742 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,11 @@
 # Prerender Buddy CLI
 
+[![npm version](https://img.shields.io/npm/v/%40prerenderbuddy%2Fcli?label=npm)](https://www.npmjs.com/package/@prerenderbuddy/cli)
+[![GitHub release](https://img.shields.io/github/v/release/kopachlager/prerenderbuddy-cli?label=release)](https://github.com/kopachlager/prerenderbuddy-cli/releases)
+[![CI](https://github.com/kopachlager/prerenderbuddy-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/kopachlager/prerenderbuddy-cli/actions/workflows/ci.yml)
+[![license](https://img.shields.io/npm/l/%40prerenderbuddy%2Fcli)](./LICENSE)
+[![Node.js](https://img.shields.io/node/v/%40prerenderbuddy%2Fcli)](./package.json)
+
 Open-source diagnostics for checking what public websites return to crawlers.
 
 The CLI inspects returned HTML, compares browser-style and crawler-style responses, and validates common discovery files. It does not render JavaScript, change a website, require a Prerender Buddy account, or predict search rankings, indexing, AI citations, mentions, or traffic.
@@ -95,6 +101,22 @@ Exit codes:
 
 JSON fields are intended to become stable at `1.0.0`. Before then, minor releases may add or refine diagnostic fields.
 
+### GitHub Actions
+
+Copy [`examples/github-actions/crawler-readability.yml`](https://github.com/kopachlager/prerenderbuddy-cli/blob/main/examples/github-actions/crawler-readability.yml)
+into the target repository as `.github/workflows/crawler-readability.yml`, then replace
+`https://example.com` with the production URL.
+
+The example:
+
+- checks crawler-readable HTML as Googlebot;
+- compares browser-style and GPTBot responses;
+- validates `robots.txt`, `sitemap.xml`, and `llms.txt`;
+- fails only on critical findings by default;
+- pins the CLI version so updates are reviewed deliberately.
+
+Run the workflow on pull requests, manually, or adapt its triggers to the deployment process.
+
 ## Safety and privacy
 
 - no telemetry;
diff --git a/examples/github-actions/crawler-readability.yml b/examples/github-actions/crawler-readability.yml
new file mode 100644
index 0000000..5be83af
--- /dev/null
+++ b/examples/github-actions/crawler-readability.yml
@@ -0,0 +1,39 @@
+name: Crawler readability
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  crawler-readability:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      SITE_URL: https://example.com
+    steps:
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "24"
+
+      - name: Check crawler-readable HTML
+        run: >-
+          npx --yes @prerenderbuddy/cli@0.1.1
+          check "$SITE_URL"
+          --user-agent googlebot
+          --fail-on critical
+
+      - name: Compare browser and AI crawler responses
+        run: >-
+          npx --yes @prerenderbuddy/cli@0.1.1
+          compare "$SITE_URL"
+          --user-agent gptbot
+          --fail-on critical
+
+      - name: Validate discovery files
+        run: >-
+          npx --yes @prerenderbuddy/cli@0.1.1
+          files "$SITE_URL"
+          --fail-on critical
diff --git a/package-lock.json b/package-lock.json
index 1957e0a..bb58d4c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@prerenderbuddy/cli",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@prerenderbuddy/cli",
-      "version": "0.1.1",
+      "version": "0.1.2",
       "license": "Apache-2.0",
       "bin": {
         "prerenderbuddy": "bin/prerenderbuddy.js"
diff --git a/package.json b/package.json
index addffd1..164a362 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@prerenderbuddy/cli",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Open-source crawler-readability and discovery-file diagnostics for public websites.",
   "homepage": "https://github.com/kopachlager/prerenderbuddy-cli#readme",
   "repository": {